The present invention relates generally to Wireless Local Area Network (WLAN) and more specifically to a system and method that allow a WLAN to provide a wireless client with alternate profiles.
Currently, to establish an EEE 802.11 wireless LAN connection, some configuration of the client devices is expected; for instance, the client may be configured to use specific SSID(s) (Service Set Identifiers), power settings, security properties and QoS (Quality of Service) parameters to name a few. Specifically, when a resource requests such as authorization and QoS occur, there may be instances when a client may need to be dynamically configured and switched to use a specific 802.11 profile. For instance, with IEEE 802.1X user authentication and Cisco Network Admission Control (NAC), WLAN clients are likely to be put on different Virtual LANs (VLANs) based on their user credentials and/or posture. Another example is that based on the applications used by the WLAN client; it may need to be placed on a different SSID and VLAN if it is using a voice or video application. Each VLAN typically has its own security profile including a unique key and protection mechanism (e.g. TKIP, AES-CCMP, etc) to ensure its broadcast and multicast streams are protected.
Under the current IEEE 802.11 protocol, if a client's resource request such as SSID, security or bandwidth allocation does not match its authorization policy, the client may be disassociated or deauthenticated causing the disruption of service to the client. Furthermore, there is no mechanism for the client to discover permitted wireless network access parameters, other than the given deauthentication/disassociation status code, for the disruption of service. Existing IEEE 802.11 management frames only facilitate disassociation/deauthentication with generic and vague error codes such as previous authentication is no longer valid, but there exists no mechanism for an Access Point (AP) to transmit new wireless network access parameters. Clients currently rely on manual pre-configuration and trials of auto profile switching to land on the correct profiles. Even if the correct profile is finally being used, the client must still go through the authentication process again to get the link layer encryption key, as the keys generated during the previous association were not kept and used.